Introduction
Attackers can pull admin credentials and reset tokens out of Strapi deployments by abusing a flaw in the document service lookup operator. The vulnerability affects organizations running Strapi 5.0.0 through 5.5.1 and exposes sensitive data that API queries should never be able to reach.
Strapi is a widely used open-source headless content management system that powers thousands of web applications and APIs around the world. Developers and enterprises that want a customizable CMS often pick it because it is flexible and easy to extend. With an install base that large and a community that active, a Strapi vulnerability has broad real-world impact, especially for organizations that rely on its API-driven architecture.
Technical information
CVE-2024-56143 sits in Strapi's document service, in the lookup operator introduced in version 5. The operator allows flexible queries against content types, but in versions 5.0.0 through 5.5.1 it does not properly sanitize query parameters that reference private fields. Strapi uses private fields to hold sensitive data such as password hashes and reset tokens, and public API queries should never be able to read them.
The lookup operator's parameter handling does not check whether a queried field is marked as private in the content type schema. If an attacker writes a query that names a private field (for example, password or resetPasswordToken), the system does not block the request. The API response can then include the values of those fields, which breaks data confidentiality.
The issue is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) because the system lets user-supplied query parameters decide which fields it accesses and does not enforce proper authorization checks on them. The root cause is insufficient validation in how the lookup operator processes query parameters.
Strapi 5.5.2 fixes the vulnerability. Its updated sanitization logic detects any reference to a private field in query parameters and rejects it before the query runs.
Affected systems and versions
- Strapi versions 5.0.0 through 5.5.1 are affected
- The vulnerable component is the document service lookup operator
- Only systems running these versions are vulnerable. Version 5.5.2 and later are not affected
Vendor security history
Strapi has had similar vulnerabilities involving private field exposure and authorization bypass before:
- CVE-2023-22894: Allowed filtering on private fields, exposing sensitive user data
- CVE-2023-34235: Bypassed the CVE-2023-22894 fix through SQL table alias manipulation
The vendor usually responds promptly to security disclosures and runs a public security advisory process. Even so, private field exposure keeps coming back, which points to ongoing trouble with query parameter validation and sanitization in the codebase.
